Network monitoring involves observing the connectivity and operational status of network entities in a computer network. Network monitoring systems enable network owners and/or administrators to take corrective action when a network entity has failed or when a link connecting one or more network entities exhibits degraded transmission performance or failure. Typically, network monitoring systems include a configuration of monitors that are configured process network monitoring signals in order to detect and identify a variety of network failure event types. Upon detecting a failure event, a network monitoring system may be configured to generate data about the failure event, such as alerts or notifications, as well as data which may activate one or more redundant failover systems to mitigate or fix the observed failure event. Network failure events that are observed for a specific network entity, a collection of network entities or links connecting combinations entities may result in down-stream failures for the network entities or links that are connected to the specific network entity or link that failed. Identifying the root cause of a particular network failure event is valuable for understanding the nature and cause of the network failure so that preventative measures can be planned in advance for specific failure conditions to ensure that the network continues to operate as intended. Root causes may be correlated based on the topology of the network and the specific inter-connectedness of network entities operating in the network. The scale and complexity of modern network systems makes correlating root causes associated with failure events in real-time a non-trivial data analytics problem when considering the interdependencies of millions of network entities operating in different sub-networks, network layers, and/or domains.